{"cves":[{"id":"CVE-2021-21123","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nInsufficient data validation in File System API in Google Chrome prior to\n88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions\nvia a crafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21123"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21122","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nUse after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a\nremote attacker to potentially exploit heap corruption via a crafted HTML\npage.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21122"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21121","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nUse after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96\nallowed a remote attacker to potentially perform a sandbox escape via a\ncrafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":9.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21121"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21120","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nUse after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a\nremote attacker to potentially exploit heap corruption via a crafted HTML\npage.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21120"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21119","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nUse after free in Media in Google Chrome prior to 88.0.4324.96 allowed a\nremote attacker who had compromised the renderer process to potentially\nexploit heap corruption via a crafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21119"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21118","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nInsufficient data validation in V8 in Google Chrome prior to 88.0.4324.96\nallowed a remote attacker to potentially perform out of bounds memory\naccess via a crafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21118"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21117","published":"2021-02-09T14:15:00","updated_at":"2025-08-25T23:31:04.650046+00:00","description":"\nInsufficient policy enforcement in Cryptohome in Google Chrome prior to\n88.0.4324.96 allowed a local attacker to perform OS-level privilege\nescalation via a crafted file.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-21117"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980564"],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26937","published":"2021-02-09T13:00:00","updated_at":"2025-08-25T23:34:07.121352+00:00","description":"\nencoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a\ndenial of service (invalid write access and application crash) or possibly\nhave unspecified other impact via a crafted UTF-8 character sequence.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"as of 2021-02-18, proposed patch on mailing list not yet\ncommited to upstream repo, but has been released by Debian"}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html","https://seclists.org/oss-sec/2021/q1/124","https://seclists.org/oss-sec/2021/q1/129","https://ubuntu.com/security/notices/USN-4747-1","https://ubuntu.com/security/notices/USN-4747-2","https://www.cve.org/CVERecord?id=CVE-2021-26937"],"bugs":["https://savannah.gnu.org/bugs/?60030"],"patches":{"screen":[]},"tags":{},"packages":[{"name":"screen","source":"https://ubuntu.com/security/cve?package=screen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=screen","debian":"https://tracker.debian.org/pkg/screen","statuses":[{"release_codename":"bionic","status":"released","description":"4.6.2-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"4.8.0-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"4.8.0-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4.8.0-5build2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4.1.0~20120320gitdb59704-9ubuntu0.1~esm2","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"4.3.1-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4747-1","USN-4747-2"],"notices":[{"id":"USN-4747-1","title":"GNU Screen vulnerability","summary":"GNU Screen could be made to crash or run programs if it processed specially\ncrafted character sequences.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-02-24T13:58:42.115382","description":"Felix Weinmann discovered that GNU Screen incorrectly handled certain\ncharacter sequences. A remote attacker could use this issue to cause GNU\nScreen to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","is_hidden":false,"release_packages":{"bionic":[{"name":"screen","version":"4.6.2-1ubuntu1.1","description":"terminal multiplexer with VT100/ANSI terminal emulation","is_source":true},{"name":"screen","version":"4.6.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.6.2-1ubuntu1.1","pocket":"security"},{"name":"screen-udeb","version":"4.6.2-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.6.2-1ubuntu1.1","pocket":"security"}],"focal":[{"name":"screen","version":"4.8.0-1ubuntu0.1","description":"terminal multiplexer with VT100/ANSI terminal emulation","is_source":true},{"name":"screen","version":"4.8.0-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.8.0-1ubuntu0.1","pocket":"security"},{"name":"screen-udeb","version":"4.8.0-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.8.0-1ubuntu0.1","pocket":"security"}],"groovy":[{"name":"screen","version":"4.8.0-2ubuntu0.1","description":"terminal multiplexer with VT100/ANSI terminal emulation","is_source":true},{"name":"screen","version":"4.8.0-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.8.0-2ubuntu0.1","pocket":"security"},{"name":"screen-udeb","version":"4.8.0-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.8.0-2ubuntu0.1","pocket":"security"}],"xenial":[{"name":"screen","version":"4.3.1-2ubuntu0.1","description":"terminal multiplexer with VT100/ANSI terminal emulation","is_source":true},{"name":"screen","version":"4.3.1-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.3.1-2ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2021-26937"]},{"id":"USN-4747-2","title":"GNU Screen vulnerability","summary":"GNU Screen could be made to crash or run programs if it processed specially\ncrafted character sequences.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-02-24T19:56:30.857628","description":"USN-4747-1 fixed a vulnerability in screen. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Felix Weinmann discovered that GNU Screen incorrectly handled certain\n character sequences. A remote attacker could use this issue to cause GNU\n Screen to crash, resulting in a denial of service, or possibly execute\n arbitrary code.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"screen","version":"4.1.0~20120320gitdb59704-9ubuntu0.1~esm2","description":"terminal multiplexer with VT100/ANSI terminal emulation","is_source":true},{"name":"screen","version":"4.1.0~20120320gitdb59704-9ubuntu0.1~esm2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/screen","version_link":"https://launchpad.net/ubuntu/+source/screen/4.1.0~20120320gitdb59704-9ubuntu0.1~esm2"}]},"type":"USN","cves_ids":["CVE-2021-26937"]}]},{"id":"CVE-2021-26925","published":"2021-02-09T09:15:00","updated_at":"2025-08-25T23:34:02.477591+00:00","description":"\nRoundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS)\ntoken sequences during HTML email rendering.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://roundcube.net/news/2021/02/08/security-update-1.4.11","https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596","https://www.cve.org/CVERecord?id=CVE-2021-26925"],"bugs":[""],"patches":{"roundcube":["upstream: https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"]},"tags":{},"packages":[{"name":"roundcube","source":"https://ubuntu.com/security/cve?package=roundcube","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=roundcube","debian":"https://tracker.debian.org/pkg/roundcube","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"1.4.11+dfsg.1-4","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.5.0+dfsg.1-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.11","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-14391","published":"2021-02-08T23:15:00","updated_at":"2025-08-01T19:35:55.868565+00:00","description":"\nA flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8\nversions prior to 8.2, where it improperly uses Red Hat Customer Portal\ncredentials when a user registers a system through the GNOME Settings User\nInterface. This flaw allows a local attacker to discover the Red Hat\nCustomer Portal password. The highest threat from this vulnerability is to\nconfidentiality.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"This bug is specific to Red Hat and does not affect Ubuntu as we do not ship the Red Hat Subscription Manager"}],"codename":null,"priority":"negligible","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://access.redhat.com/security/cve/CVE-2020-14391","https://www.cve.org/CVERecord?id=CVE-2020-14391"],"bugs":[""],"patches":{"gnome-settings-daemon":[]},"tags":{},"packages":[{"name":"gnome-settings-daemon","source":"https://ubuntu.com/security/cve?package=gnome-settings-daemon","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gnome-settings-daemon","debian":"https://tracker.debian.org/pkg/gnome-settings-daemon","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-13947","published":"2021-02-08T22:15:00","updated_at":"2025-07-11T07:43:23.884634+00:00","description":"\nAn instance of a cross-site scripting vulnerability was identified to be\npresent in the web based administration console on the message.jsp page of\nApache ActiveMQ versions 5.15.12 through 5.16.0.","ubuntu_description":"","notes":[{"author":"allenpthuang","note":"Debian notes: admin console not enabled therefore not affected."}],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://activemq.apache.org/security-advisories.data/CVE-2020-13947-announcement.txt","https://www.cve.org/CVERecord?id=CVE-2020-13947"],"bugs":[""],"patches":{"activemq":[]},"tags":{},"packages":[{"name":"activemq","source":"https://ubuntu.com/security/cve?package=activemq","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=activemq","debian":"https://tracker.debian.org/pkg/activemq","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26222","published":"2021-02-08T21:15:00","updated_at":"2025-12-12T13:55:32.467255+00:00","description":"\nThe ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB\nwrite when opening XML file after exhausting the memory pool.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-26222"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989363","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989364","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989360","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989361"],"patches":{"mapcache":[],"scilab":[],"netcdf":["upstream: https://github.com/Unidata/netcdf-c/commit/b5d4afd1d55b4ead340ed6d1b4eb1c7016e843cc"],"netcdf-parallel":[],"navit":[]},"tags":{},"packages":[{"name":"mapcache","source":"https://ubuntu.com/security/cve?package=mapcache","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mapcache","debian":"https://tracker.debian.org/pkg/mapcache","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"noble","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"}]},{"name":"scilab","source":"https://ubuntu.com/security/cve?package=scilab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=scilab","debian":"https://tracker.debian.org/pkg/scilab","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"}]},{"name":"netcdf-parallel","source":"https://ubuntu.com/security/cve?package=netcdf-parallel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf-parallel","debian":"https://tracker.debian.org/pkg/netcdf-parallel","statuses":[{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-2build2","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.0-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.0-6build1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-2build1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"}]},{"name":"navit","source":"https://ubuntu.com/security/cve?package=navit","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=navit","debian":"https://tracker.debian.org/pkg/navit","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"netcdf","source":"https://ubuntu.com/security/cve?package=netcdf","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf","debian":"https://tracker.debian.org/pkg/netcdf","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.2-5ubuntu4","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [changes too intrusive]","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.3-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26221","published":"2021-02-08T21:15:00","updated_at":"2025-12-12T13:55:55.441665+00:00","description":"\nThe ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB\nwrite when opening XML file after exhausting the memory pool.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-26221"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989363","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989364","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989360","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989361"],"patches":{"mapcache":[],"scilab":[],"netcdf":["upstream: https://github.com/Unidata/netcdf-c/commit/b5d4afd1d55b4ead340ed6d1b4eb1c7016e843cc"],"netcdf-parallel":[]},"tags":{},"packages":[{"name":"mapcache","source":"https://ubuntu.com/security/cve?package=mapcache","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mapcache","debian":"https://tracker.debian.org/pkg/mapcache","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"scilab","source":"https://ubuntu.com/security/cve?package=scilab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=scilab","debian":"https://tracker.debian.org/pkg/scilab","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"}]},{"name":"netcdf-parallel","source":"https://ubuntu.com/security/cve?package=netcdf-parallel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf-parallel","debian":"https://tracker.debian.org/pkg/netcdf-parallel","statuses":[{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.0-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.0-6build1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-2build2","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-2build1","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"}]},{"name":"netcdf","source":"https://ubuntu.com/security/cve?package=netcdf","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf","debian":"https://tracker.debian.org/pkg/netcdf","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.2-5ubuntu4","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [changes too intrusive]","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.3-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26220","published":"2021-02-08T21:15:00","updated_at":"2025-12-12T13:55:42.753066+00:00","description":"\nThe ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB\nwrite when opening XML file after exhausting the memory pool.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-26220"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989363","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989364","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989360","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989361"],"patches":{"mapcache":[],"scilab":[],"netcdf":["upstream: https://github.com/Unidata/netcdf-c/commit/b5d4afd1d55b4ead340ed6d1b4eb1c7016e843cc"],"netcdf-parallel":[]},"tags":{},"packages":[{"name":"mapcache","source":"https://ubuntu.com/security/cve?package=mapcache","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mapcache","debian":"https://tracker.debian.org/pkg/mapcache","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was ignored [will not be fixed upstream]","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"will not be fixed upstream","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"scilab","source":"https://ubuntu.com/security/cve?package=scilab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=scilab","debian":"https://tracker.debian.org/pkg/scilab","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"netcdf-parallel","source":"https://ubuntu.com/security/cve?package=netcdf-parallel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf-parallel","debian":"https://tracker.debian.org/pkg/netcdf-parallel","statuses":[{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.0-6build1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-2build2","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.0-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-2build1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"}]},{"name":"netcdf","source":"https://ubuntu.com/security/cve?package=netcdf","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=netcdf","debian":"https://tracker.debian.org/pkg/netcdf","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"changes too intrusive","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:4.9.2-5ubuntu4","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.8.2","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:4.9.3-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [changes too intrusive]","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:4.9.3-1build1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36152","published":"2021-02-08T21:15:00","updated_at":"2025-08-26T12:25:41.717789+00:00","description":"\nBuffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa\n0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/hoene/libmysofa/issues/136","https://www.cve.org/CVERecord?id=CVE-2020-36152"],"bugs":[""],"patches":{"libmysofa":[]},"tags":{},"packages":[{"name":"libmysofa","source":"https://ubuntu.com/security/cve?package=libmysofa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmysofa","debian":"https://tracker.debian.org/pkg/libmysofa","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36151","published":"2021-02-08T21:15:00","updated_at":"2025-08-26T12:25:41.717789+00:00","description":"\nIncorrect handling of input data in mysofa_resampler_reset_mem function in\nthe libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and\noverwriting large memory block.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/hoene/libmysofa/issues/134","https://www.cve.org/CVERecord?id=CVE-2020-36151"],"bugs":[""],"patches":{"libmysofa":[]},"tags":{},"packages":[{"name":"libmysofa","source":"https://ubuntu.com/security/cve?package=libmysofa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmysofa","debian":"https://tracker.debian.org/pkg/libmysofa","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36150","published":"2021-02-08T21:15:00","updated_at":"2025-08-26T12:25:41.717789+00:00","description":"\nIncorrect handling of input data in loudness function in the libmysofa\nlibrary 0.5 - 1.1 will lead to heap buffer overflow and access to\nunallocated memory block.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/hoene/libmysofa/issues/135","https://www.cve.org/CVERecord?id=CVE-2020-36150"],"bugs":[""],"patches":{"libmysofa":[]},"tags":{},"packages":[{"name":"libmysofa","source":"https://ubuntu.com/security/cve?package=libmysofa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmysofa","debian":"https://tracker.debian.org/pkg/libmysofa","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36149","published":"2021-02-08T21:15:00","updated_at":"2025-08-26T12:25:41.717789+00:00","description":"\nIncorrect handling of input data in changeAttribute function in the\nlibmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and\nsegmentation fault error in case of restrictive memory protection or near\nNULL pointer overwrite in case of no memory restrictions (e.g. in embedded\nenvironments).","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/hoene/libmysofa/issues/137","https://www.cve.org/CVERecord?id=CVE-2020-36149"],"bugs":[""],"patches":{"libmysofa":[]},"tags":{},"packages":[{"name":"libmysofa","source":"https://ubuntu.com/security/cve?package=libmysofa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmysofa","debian":"https://tracker.debian.org/pkg/libmysofa","statuses":[{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36148","published":"2021-02-08T21:15:00","updated_at":"2025-08-26T12:25:41.717789+00:00","description":"\nIncorrect handling of input data in verifyAttribute function in the\nlibmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and\nsegmentation fault error in case of restrictive memory protection or near\nNULL pointer overwrite in case of no memory restrictions (e.g. in embedded\nenvironments).","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/hoene/libmysofa/issues/138","https://www.cve.org/CVERecord?id=CVE-2020-36148"],"bugs":[""],"patches":{"libmysofa":[]},"tags":{},"packages":[{"name":"libmysofa","source":"https://ubuntu.com/security/cve?package=libmysofa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmysofa","debian":"https://tracker.debian.org/pkg/libmysofa","statuses":[{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.2~dfsg0-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26910","published":"2021-02-08T20:15:00","updated_at":"2025-08-26T12:29:50.258472+00:00","description":"\nFirejail before 0.9.64.4 allows attackers to bypass intended access\nrestrictions because there is a TOCTOU race condition between a stat\noperation and an OverlayFS mount operation.","ubuntu_description":"\nRoman Fiedler discovered that a race condition existed in Firejail\nwhen using OverlayFS to prevent writes to the underlying file system. A\nlocal attacker could use this to gain administrative privileges. Note:\nthis update disables support for OverlayFS in Firejail.","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2021/02/08/5","https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt","https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/","http://www.openwall.com/lists/oss-security/2021/02/09/1","https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b","https://github.com/netblue30/firejail/releases/tag/0.9.64.4","https://ubuntu.com/security/notices/USN-5141-1","https://www.cve.org/CVERecord?id=CVE-2021-26910"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/firejail/+bug/1916767"],"patches":{"firejail":[]},"tags":{},"packages":[{"name":"firejail","source":"https://ubuntu.com/security/cve?package=firejail","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firejail","debian":"https://tracker.debian.org/pkg/firejail","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.9.62-3ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.9.64.4-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-5141-1"],"notices":[{"id":"USN-5141-1","title":"Firejail vulnerability","summary":"Firejail could be made to overwrite files as the administrator.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-11-11T07:52:38.881025","description":"Roman Fiedler discovered that a race condition existed in Firejail\nwhen using OverlayFS to prevent writes to the underlying file system. A\nlocal attacker could use this to gain administrative privileges. Note:\nthis update disables support for OverlayFS in Firejail.\n","is_hidden":false,"release_packages":{"focal":[{"name":"firejail","version":"0.9.62-3ubuntu0.1","description":"Application sandbox","is_source":true},{"name":"firejail","version":"0.9.62-3ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/firejail","version_link":"https://launchpad.net/ubuntu/+source/firejail/0.9.62-3ubuntu0.1","pocket":"security"},{"name":"firejail-profiles","version":"0.9.62-3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/firejail","version_link":"https://launchpad.net/ubuntu/+source/firejail/0.9.62-3ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2021-26910"]}]}],"offset":43440,"limit":20,"total_results":79316}